ssh ciphers issue JIRA and Confluence

Hi ,

We have successfully migrated and upgraded JIRA and Confluence applications to latest versions. JIRA(7.4.1) and Confluence(6.2.4) in DEV Environment.

We have not used a secure connection(https) as we are in DEV environment.

After the applications were successfully upgraded to the latest available versions, we need to have a scan of the application servers by the network team here.

Below is the response from our network team after the security scan of the JIRA and Confluence application servers.

#############################################################

The following ssh ciphers were marked as an issue:
 
  • arcfour
  • arcfour128
  • arcfour256
I have personally never seen these ciphers before and they have never come up on any scans we have done in the past so it could be something that the application setup which needs to be verified because if that is not the case I will need to remove them. If the application did install them than we need a validation of why they are required which will have to be signed off by security.

#############################################################

Thanks,

Nav

2 comments

Daniel Eads Community Champion Aug 01, 2017

Hi Nav,

JIRA/Confluence installs don't modify openssh. Those ciphers weren't enabled or modified by Atlassian applications, so you should be able to disable them without adversely affecting your application installs.

I can't advise you specifically on how to disable those ciphers as I don't know what distribution you're running, but it should be easy enough to Google for your distribution + "disable arcfour cipher".

Good luck!

It's not clear what was tested here.  If you're just using JIRA and Confluence on http though, it could not have been them.

For most ssh daemons, look in the sshd_config , found typically in /etc/ssh/ .   You should probably check ssh_config while you're there too.

If it is the JIRA/Confluence you need to check, then you will either need to look at the proxy you have in front of them, or the Tomcat "connector" settings in server.xml

Comment

Log in or Join to comment
Community showcase
Sarah Schuster
Posted Jan 29, 2018 in Jira

What are common themes you've seen across successful & failed Jira Software implementations?

Hey everyone! My name is Sarah Schuster, and I'm a Customer Success Manager in Atlassian specializing in Jira Software Cloud. Over the next few weeks I will be posting discussion topics (8 total) to ...

2,897 views 12 18
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot